Hot answers tagged

18

I am only directly aware of one issue with BFD, which is CPU demand. I am currently investigating an issues with a Cisco 7301 which when pushing more traffic during our peak hours, compared to the rest of the day, BFD is sometimes timing out and routing trips over to the next link. It seems that under high traffic volumes the router CPU usage is rising (...


13

Is this okay? Hardly ideal. I assume since you are using cheap, obsolete switches, that you're on a very limited budget. You'll have to weigh the factors below. Does a cascade of switches affect overall performance? The problem with cascading switches is that you are concentrating traffic on the links to upstream switches. For example, the last switch ...


11

This really depends on the network topology and size, budget, and of course, your security policies! My answer below isn't really a direct answer to your question. If you post a topology map or give further information, a more precise answer can be given. Instead I have given some guidelines on IPSs in general, that apply to various situations including the ...


10

Not sure this is a question that can get a really good answer but it's important to know the preference order of OSPF: intra area routes inter area routes external type 1 external type 2 NSSA type 1 NSSA type 2 So in some cases adjusting the metric has no effect on traffic engineering. It's important to change the auto-cost reference-bandwidth on Cisco ...


10

It's fine to reuse VLANs on segments that will never meet at layer 2.


8

A tunnel is your only way out here, unfortunately. Without using a tunnel a packet would enter the service providers network and if that destination isn't already known it will get thrown down the black hole. I would hope and assume that the provider isn't doing any special policing on tunneled traffic, but you'll have to test that out for yourself. If you'...


8

Ethernet over fiber works the same as Ethernet over copper wire (for the most part), so the networking configuration will essentially be the same. But you mention a bag of tools -- you should know that the tolerances for fiber connecters are way more strict than RJ45 connectors. Fiber ends need to be cut a certain way, cleaned, polished to remove ...


8

There is no significant reasons to use different vlan in your situation, but, some vendors(cisco at least) recommends to use this way: for example, we have N branches, and we need four routed broadcast domains(LAN) on each, let`s calculate them: branch1 = 1 branch2 = 2 ... branchN = N worstations - ip:10.N.0.0/24, vlan 100+N servers - 10.N.64.0/24, vlan ...


7

I know the 3750X's have a management interface on the back which is a 10/100 Fast ethernet port. Its right next to the RJ-45 console port. I also believe that the 2960 switch that you listed there also has a management port on the front of it, above the SFP ports. Assuming your switches aren't too far away, you could use the management interfaces to manage ...


7

If you are using the same provider for your primary and backup MPLS connections, it is almost a certainty that they are the same network. Even if you were to use a different technology for your backup links (e.g, frame relay), the provider would likely provision that over their MPLS network. I know you want a simple answer, but your question is pretty ...


7

For smaller deployments a Collapsed Core is usually fine. Collapsed Core means that some devices perform both Distribution and Core layer duties. With just a few Access switches there's no need to build a large Core. If you have a large network then you will have many Access switches. Let's say that you have 20 Distribution switches. Connecting all the ...


7

I think BGP is probably your best bet in this situation. The number of tail sites you have quickly exceeds the benefits of most IGPs. BGP would allow you to achieve all of your desired implementation requirements, such as limiting tail site knowledge to the primary/backup DC, standards based protocol, ability to efficiently handle over 5,000 different ...


7

You certainly could use a L2 switch, and it would probably work just fine. But here are a few reasons why a L3 switch might be a better choice: You may want to segregate your servers into different VLANs to simplify access control, apply QoS, limit failure domains, etc. An L3 switch will make this much easier. While Firewalls can run routing protocols, ...


7

The Core layer is responsible for fast transportation across a network. The more intelligent routing you try and perform there the more you slow down the rate of packet flow. You don't want to have a WAN Router also be doing VLAN routing, if you don't have to. You want it receive traffic not bound for the LAN and send it out over the internet or MPLS network....


7

Pushing full routes into a load balancer is about as far from best practice as you can get. Give it a default route to an actual router and a static route back to your subnets and it should be able to do anything you'd want. This also leaves you free to use that actual router to terminate multiple connections for diversity / best path options without ...


7

There are several reasons for not chaining switches, all of which relate to performance with the parameters effective throughput, resilience, latency. As Ron has aptly pointed out, more aggregation means more bandwidth competition - all users behind a core switch port compete for the bandwidth of that single port. In another perspective, the longer a ...


6

You seem to be going about this the right way (which is the only real question I can find in your post), but I will throw in a few more considerations and/or options. With this many APs deployed and as many users as you expect (and the other non-802.11 devices they bring with such as bluetooth), what is the noise floor in 2.4GHz? It may be that your noise ...


6

Single fiber and single wavelength are fundamentally incompatible. You either need two fibers (send at each end connected to receive at the other end) and one wavelength is fine, or you need two different wavelengths so that data can travel both ways over the same fiber without conflict. 10Gb does not include a half-duplex option, which would be the only ...


6

Usually this is discussed in the context of network capture appliances. So - for example - if you have taps on four links and a given packet happens to traverse all four then you'll naturally see four copies of the same packet. De-duplication is the capability to deliver only one copy of this packet to a protocol analyzer. ETA: Some actual use-cases ...


6

Yes. You do not want to extend Layer 2 MAN links beyond the border of each location - this is bad design for a number of reasons: You will extend the broadcast domain of all 5 sites up to the main site Layer 2 issues (STP re-convergence, broadcast storms etc) can now affect multiple sites at once It will not scale in the future as you bring on more sites, ...


6

Additional comments: Remember to allow for growth too - no new switch should be installed fully populated. There should always be some spare ports. I've seen recommendations from 50% full to at least 20% empty ports. That includes your core switch stack. Stack? Yes if your budget stretches that far, the core switch should be a stack of two switches and ...


6

This design is ok only if you are willing to accept a single point of failure for all office switches, web farm, sql, file-server and internet. This design is ok only if you are willing to accept periodic spanning-tree hits every time links flap. By the way, the Cisco SG series doesn't support rapid-pvst, so you have to live with one spanning-tree for all ...


5

Change the L2 links to L3 for the offices. ( Get help if needed) This will prevent one of the uplinks to the offices blocking and provide double the bandwidth. (Assuming that there is a link from each DC the same size) There is no chance of a spanning tree loop at a branch affecting the DC's Broadcasts from any device on any site does not travel to all the ...


5

From a design standpoint, specifically referring to the route servers, the answer is no, they should not peer with each other via an iBGP session [disclaimer: I've never personally attempted to do this, but I might now for fun]. The reason why is because route servers behave similary to route reflectors, only it's eBGP rather than iBGP. The most important ...


5

Costing is often used to merge traffic flows together and achieve better utilization of available bandwidth, but costing can also be used to divide traffic and promote symmetry. Consider this campus design in which each building has two distribution switches and two fiber uplinks. A combination of spanning tree root, hsrp and ospf cost provides perfect ...


5

I have seen two reasons why BFD hasn't been implemented: Ignorance of it (I was guilty of this for some time). Cost, if you're a Cisco shop. Although possibly negligible depending on the size of your organization, there is now an associated licensing cost to implement BFD. As of the ISR G2/ASR timeframe, BFD is no longer in the "IP Base" licensing package....


5

There's a bunch of stuff to consider here, although a lot of it depends on your environment. First, device flexibility. If there's an emergency update that needs a reboot of the device to take effect, are you ready to take down the combined services to deal with that update? This can become a rabbit's hole of "what if?" scenarios but it's something to think ...


5

If you have proper security policies in place, there is no need to separate these two devices out. If you have a properly spec'd firewall, then performance is not a reason to separate them out either. It's good of the vendor to tell you to split these two out as they end up selling you two firewalls instead of a single device.


5

I would strongly recommend moving to an OSPF/iBGP design for something of this scale, with the core switches acting as BGP route reflectors. BGP has so many more administrative handles for tinkering with routes over OSPF, allowing better scale and filtering. If you scale to the point that you have more networks than your ToR switches can program into CAM (...


5

The layer you labeled in your diagram is considered the core (also called the backbone). The firewalls in your diagram form a boundary on the core layer, since they transition to another network. Core networks are local to your company or autonomous system. Keep your core layer as stable as possible. That typically means keeping changes to a minimum, ...


Only top voted, non community-wiki answers of a minimum length are eligible